Comment by dxf | Hacker News Reader

Comment by dxf | Hacker News Reader

Parent Full thread

The huge advantage of biometrics (fingerprints, FaceID, etc.) is the ease with which a user can unlock their phone. A passcode may be better than a fingerprint, but a fingerprint+longer passcode is better than a shorter passcode (or no passcode at all).

Having a 12 character alphanumeric passphrase you enter each time you want to unlock is not something most users want to do.

See e.g.: https://www.businesstoday.in/technology/news/story/what-kick...

Only about 49 per cent of the users were setting a passcode, which meant that the remaining 51 per cent were not benefiting from the data protection mechanism. When Apple dug in to understand the reason, the findings revealed that users unlock their devices a lot - on an average about 80 times a day. And about half of its users simply didn't want the inconvenience of having to enter their passcode into their device, at times. At that time, in 2012-2013, the default passcode length for iPhone was four digits, which happens to be six today.

Apple realised that it needed to come up with a mechanism that's fast and secure, and doesn't involve typing in the passcode. That's when Apple introduced Touch ID, which was easy, fast and secure. The way that biometric authentication worked on Apple platforms was that the user must set a passcode to be able to use the biometrics. And just as Apple thought, there was a much higher adoption of biometric-based TouchID. Apple says over 92 per cent chose to use Touch ID and had therefore set the passcode, which in turn meant users were able to use Apple's data protection encryption system.

> The huge advantage of biometrics ... is the ease with which a user can unlock their phone

This does not prevent involuntary unlocking - it actually can allow for eased against-will unlocking.

«Ease» and security may sometimes not be friends.

At least on iPhones though they have a way to activate a mode that prevents the use of TouchID and FaceID. If I press the power button on my phone 5 times in a row that turns that off.

Yes I still run the risk of my device being unlocked against my will if I'm caught by surprise. But I'm able to disable this functionality in places where I think the risk of that may be higher, e.g. while traveling.

I'll still take the trade off of longer password (not just a few numbers) on my phone while using a biometric test for normal access.

Of course not everyone may have the same threats to consider and others may make different choices. Doesn't make either of our choices wrong.

On modern FaceID phones you need to hold the power and down volume key to bring up the Reset/PowerOff and cancel. Just clicking multiple times will bring up wallet, siri, or do nothing.

Just clicking multiple times will bring up wallet, siri, or do nothing.

On my iPhone 13, just now, I rapidly clicked the power button 5x.

The phone immediately made a loud sound and put up a screen that said "Emergency SOS". There was an option to "cancel" it, but I assume that the phone would have contacted 911 in short order unless I quickly cancelled.

So the correct description is probably "it depends".

There is an option in the settings to make it not actually call unless you press a further UI button on the iPhone.

In Settings go to Emergency SOS. Uncheck Auto Call

My Android phone did exactly the same. Very loudly and unexpectedly.

Just hit the power button 5 times on my iPhone 13 Pro, and it locked down FaceID as I'd expect (while bringing up the Reset/Power Off screen). You've described an alternative method, not the only.

Which OS are you updated to (no please don't post it)? not 15.1.x? Have you disabled wallet, Siri, and SOS? It doesn't work on any of the 5x 12s and 13s (pro and not) I just tried. It did work on an 11, which was not updated to 15.

You also risk the accidental activation of an SOS call.

I think you need to turn on the power button clicking 5 times feature by turning on the "Call with Side Button" option in Settings under Emergency SOS. I'd also suggest turning off Auto Call if you want to use it like this.

Yes this is kinda buried and not clear at all that this function also disables FaceID but it does.

A TPM can harden a pin such that it is stronger than a biometric. As a simple example, suppose the TPM has an exponential back off algorithm such that you need to wait 1s after one wrong guess, 2s after two wrong guesses, 4s after 3, etc. No one is getting anywhere close to 64 guesses in that case much less the hundreds you might need for a 4 digit pin (assuming it isn't someone's birthday).

However, you are correct that a fingerprint is faster than even a 4 digit pin. And even a TPM does not solve the problem of pin/password reuse and being easy to guess, it just makes it harder by giving you much fewer guesses.

Reply on news.ycombinator.com